How Should Investors Evaluate a Fund's Data Security and Incident Response?
Short answer. Ask what sensitive data the fund holds, who can access it, how access is reviewed, and how the manager protects and backs up records. Then test the incident plan: who is notified, how systems are contained, and how investors receive updates. Request evidence and resolve gaps before sharing sensitive information.
Evaluate a fund's data security by identifying what information it holds, who can reach it, and how the manager would respond if an account or system were compromised. You need evidence that the fund can contain a problem, preserve records, and communicate clearly while facts are being established.
Map Sensitive Information and Access
Ask the manager to identify the sensitive records it handles, such as investor identity and financial information, subscription documents, portfolio company materials, and payment records. Find out where each category is stored and which employees or service providers can access it. Ask how access is granted, removed when someone leaves, and reviewed over time. Individual accounts and a record of access changes make it easier to investigate an incident.
Request the data security policy, an access review summary, and a list of material providers that store or process fund information. Ask how the manager protects records in transit and at rest, and whether backups are separated from ordinary user access. You do not need confidential technical diagrams. You do need a clear account of who owns the controls and what evidence supports the answer.
Test the Incident Response Plan
Ask the manager to describe what happens after a suspected disclosure, lost device, compromised email account, or unauthorized access to investor records. Who can disable an account or restrict access? Who preserves relevant records, contacts service providers, and decides what investors are told? Request the written incident response plan, named roles, escalation contacts, and a summary of a response exercise or review.
Ask direct questions:
- "Who has authority to contain a suspected incident?"
- "How do you determine which investor or fund records were affected?"
- "Who decides when and how investors are notified?"
- "How do you preserve records while investigating?"
- "What changes followed your last incident exercise or review?"
A generic statement that the manager takes security seriously does not answer these questions. A red flag is an unclear owner, no route to notify investors, or an inability to explain how the manager would assess the scope of an incident.
Check Recovery and Information Sharing
Ask how essential records would be restored if email, file storage, or a provider became unavailable. Find out who can restore backups and how the manager checks that they work. Ask how the fund maintains access to records if a vendor relationship ends. Consider the sensitivity of materials you plan to share and use the manager's stated secure channel. Confirm intended recipients before sending confidential documents.
Track gaps and requested proof in your written diligence plan. A separate review of vendor exposure can help you assess providers that store or process fund information.
Checklist
- Identify sensitive records and where they are held.
- Request the security and incident response policies.
- Confirm access review and removal procedures.
- Identify incident owners and investor communication roles.
- Ask for evidence of a response exercise or review.
- Check backup restoration and provider exit arrangements.
Read next: How do family offices manage cybersecurity and fraud risk? and What should a family office learn about a manager's business continuity plan?
The firms which make it to the top 5% of the industry and stay there have documented processes and procedures that are followed by everyone on the team.
Sources: Family Office Club investor due diligence framework, The Family Office Book. Informational only, not financial, legal or tax advice.